Security Operations

• Continuously refine correlation rules to ensure detection logic meets standards for performance, accuracy, and operational relevance
• Translate Unit 42 threat intelligence research and emerging adversary TTPs into actionable detection logic
• Design sophisticated automation playbooks to resolve emerging security challenges and optimize operational workflows
• Architect the end-to-end security lifecycle within Cortex XSIAM
• Connect data ingestion, high-fidelity detection engineering, and response automation
• Review and provide optimization feedback on detection logic written by others
• Guide enterprise customers through complex architectural and workflow decisions
• Collaborate remotely across geographies in a hybrid team environment

Senior MSIAM SOC Engineer – Unit 42

• Lead response to high-priority and escalated cybersecurity incidents focused on insider risk and telemetry-driven detection
• Establish investigation strategy, ensure timely execution, and drive incident closure
• Conduct deep-dive analysis using telemetry, endpoint/network evidence, and threat intelligence to determine scope, impact, and root cause
• Create, tune, and deploy detection rules and analytics for evolving threats and suspicious behaviors
• Perform targeted micro-hunts and translate findings into detections, controls, and playbooks
• Partner with IT and security stakeholders on containment, remediation, and recovery across endpoints, identities, and cloud services
• Contribute to incident response process improvements, documentation standards, after-action reviews, and tabletop scenarios
• Produce leadership updates and incident reports covering status, impact, risk, and next steps
• Coach and mentor analysts and serve as a subject matter expert
• Build and maintain integrations among enterprise security tools
• Implement AI-assisted monitoring and analytics for correlation, enrichment, prioritization, and alert triage
• Develop and maintain risk-scoring approaches for endpoints and users
• Produce trend analyses and operational health reporting
• Develop automation through APIs, scripting, and orchestration for deployments, compliance checks, remediation, scoping, containment, and control validation
• Investigate and resolve incidents using case management platforms, endpoint/network telemetry, and threat intelligence
• Apply incident handling methodologies and frameworks such as kill chain and MITRE ATT&CK
• Analyze threats, exploits, vulnerabilities, and malware across Windows, macOS, and Linux
• Use EDR and cloud security telemetry to scope activity and support containment/remediation
• Use Splunk and related analytics tools to query and correlate security data
• Design and tune detections for emerging threats and insider risk behaviors
• Collaborate with analytics and engineering teams across the security ecosystem

Lead Cybersecurity – Insider Risk Analyst, Telemetry, Insider Risk Detection, AI-Driven Security Operations

• Lead high-severity investigations across endpoint, identity, email, network, cloud, and SaaS telemetry
• Build and defend incident timelines and determine root cause
• Execute containment decisions including session revocation, credential resets, token invalidation, host isolation, mailbox rule removal, conditional access changes, and network blocks
• Run eradication and recovery, verify adversary removal, and eliminate persistence mechanisms
• Perform log analysis and light forensics across memory, disk, M365/Entra audit logs, proxy/firewall/VPN logs
• Preserve evidence for legal and regulatory review
• Lead PHI/PII investigations involving unauthorized access, exposed data, insider misuse, compromised devices, and third-party exposures
• Determine data involvement, access, duration, viewing, and exfiltration; document findings for HIPAA breach risk assessments
• Work with Privacy, Compliance, and Legal on breach determinations and notifications
• Coordinate takedown or remediation of exposed data
• Contribute to DLP, access reviews, data classification, and secure file-transfer controls
• Own incident communications to the CISO, security leadership, business owners, IT, Legal, Privacy, and HR
• Write incident reports and post-incident reviews
• Coordinate with MDR/MSSP, forensic retainers, cyber insurance, vendors, and third-party partners
• Tune and build SIEM detections and response playbooks
• Measure and reduce false positives, dwell time, and time to contain
• Conduct proactive threat hunts and convert findings into detections or hardening recommendations
• Identify control gaps and drive remediation with owning teams
• Mentor and review L1/L2 analyst investigations
• Maintain runbooks, severity definitions, and escalation criteria
• Participate in the on-call rotation and lead tabletop exercises

Security Incident Response Analyst

• Prepare for, detect, respond to, and mitigate cyber threats protecting Live Nation Entertainment data and assets
• Lead a geographically dispersed team of technical detection and response analysts monitoring, detecting, triaging, and responding to security events across a 24x7 global network
• Implement detection methodologies and baseline network traffic to identify anomalous activity
• Manage Threat Detection and Response team operations, including people management, training, and mentoring
• Leverage automation and orchestration solutions to automate repetitive tasks
• Collaborate with internal and external teams and subject matter experts to address cybersecurity issues and reduce organizational risk
• Support team projects and strategic initiatives to improve workflows, processes, monitoring, and response capabilities
• Assist with incident response, including threat hunting, data collection and analysis, triage, containment, remediation, and documentation
• Maintain process documentation and lessons learned, improving internal playbooks and response scalability
• Develop and deliver team efficiency and effectiveness metrics to leadership
• Manage team-member career development, training, mentoring, and performance reviews
• Promote inclusiveness and team unity while delivering customer service
• Research current cybersecurity trends, best practices, and technology developments
• Participate in required weekly on-call rotations

Security Operations jobs in North Carolina

Senior MSIAM SOC Engineer – Unit 42

Lead Cybersecurity – Insider Risk Analyst, Telemetry, Insider Risk Detection, AI-Driven Security Operations

Security Incident Response Analyst

Senior Director – Cyber Security Operations